Bug 2165824 (CVE-2022-25881) - CVE-2022-25881 http-cache-semantics: Regular Expression Denial of Service (ReDoS) vulnerability
Summary: CVE-2022-25881 http-cache-semantics: Regular Expression Denial of Service (Re...
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2022-25881
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 2174279 2174280 2165828 2165829 2165830 2165831 2165832 2165833 2165834 2165835 2165836 2165962 2165963 2166189 2166190 2166191 2166192 2174278 2174281 2174282 2174283 2174284 2174285 2174286 2174287 2175833 2175834 2175835 2175836 2178091 2178092 2178093 2178094 2178095 2178096 2178097 2178098 2178147 2178148 2178149 2187840
Blocks: 2165813
TreeView+ depends on / blocked
 
Reported: 2023-01-31 08:36 UTC by TEJ RATHI
Modified: 2024-07-29 04:27 UTC (History)
82 users (show)

Fixed In Version: http-cache-semantics 4.1.1
Clone Of:
Environment:
Last Closed: 2023-05-09 20:33:38 UTC
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHBA-2023:1546 0 None None None 2023-04-03 12:04:06 UTC
Red Hat Product Errata RHBA-2023:1776 0 None None None 2023-04-13 14:58:54 UTC
Red Hat Product Errata RHBA-2023:1799 0 None None None 2023-04-17 07:30:51 UTC
Red Hat Product Errata RHBA-2023:1807 0 None None None 2023-04-17 14:08:00 UTC
Red Hat Product Errata RHBA-2023:1808 0 None None None 2023-04-17 14:08:16 UTC
Red Hat Product Errata RHBA-2023:1856 0 None None None 2023-04-18 22:33:14 UTC
Red Hat Product Errata RHBA-2023:1927 0 None None None 2023-04-24 01:07:50 UTC
Red Hat Product Errata RHSA-2023:1428 0 None None None 2023-03-23 02:16:34 UTC
Red Hat Product Errata RHSA-2023:1533 0 None None None 2023-03-30 12:36:02 UTC
Red Hat Product Errata RHSA-2023:1582 0 None None None 2023-04-04 09:48:20 UTC
Red Hat Product Errata RHSA-2023:1583 0 None None None 2023-04-04 09:48:37 UTC
Red Hat Product Errata RHSA-2023:1742 0 None None None 2023-04-12 14:58:49 UTC
Red Hat Product Errata RHSA-2023:1743 0 None None None 2023-04-12 14:59:09 UTC
Red Hat Product Errata RHSA-2023:1744 0 None None None 2023-04-12 15:07:50 UTC
Red Hat Product Errata RHSA-2023:1887 0 None None None 2023-04-19 23:50:26 UTC
Red Hat Product Errata RHSA-2023:1888 0 None None None 2023-04-20 01:39:30 UTC
Red Hat Product Errata RHSA-2023:2061 0 None None None 2023-05-01 18:25:57 UTC
Red Hat Product Errata RHSA-2023:2083 0 None None None 2023-05-02 16:19:38 UTC
Red Hat Product Errata RHSA-2023:2098 0 None None None 2023-05-03 15:34:26 UTC
Red Hat Product Errata RHSA-2023:2104 0 None None None 2023-05-03 20:15:12 UTC
Red Hat Product Errata RHSA-2023:2654 0 None None None 2023-05-09 11:46:35 UTC
Red Hat Product Errata RHSA-2023:2655 0 None None None 2023-05-09 11:46:53 UTC
Red Hat Product Errata RHSA-2023:3815 0 None None None 2023-06-27 11:29:07 UTC
Red Hat Product Errata RHSA-2023:5533 0 None None None 2023-10-09 10:26:44 UTC

Description TEJ RATHI 2023-01-31 08:36:29 UTC 
This affects versions of the package http-cache-semantics before 4.1.1. The issue can be exploited via malicious request header values sent to a server, when that server reads the cache policy from the request using this library.

https://security.snyk.io/vuln/SNYK-JS-HTTPCACHESEMANTICS-3248783
https://github.com/kornelski/http-cache-semantics/blob/master/index.js%23L83
https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-3253332
Comment 13 Patrick Del Bello 2023-03-01 02:41:17 UTC 
Created dotnet6.0 tracking bugs for this issue:

Affects: fedora-all [bug 2174281]


Created golang-entgo-ent tracking bugs for this issue:

Affects: fedora-all [bug 2174282]


Created nodejs tracking bugs for this issue:

Affects: fedora-all [bug 2174283]


Created nodejs-nodemon tracking bugs for this issue:

Affects: fedora-all [bug 2174284]


Created nodejs:13/nodejs tracking bugs for this issue:

Affects: epel-all [bug 2174279]


Created nodejs:14/nodejs tracking bugs for this issue:

Affects: fedora-all [bug 2174285]


Created nodejs:16-epel/nodejs tracking bugs for this issue:

Affects: epel-all [bug 2174280]


Created nodejs:16/nodejs tracking bugs for this issue:

Affects: fedora-all [bug 2174286]


Created nodejs:18/nodejs tracking bugs for this issue:

Affects: fedora-all [bug 2174287]


Created zuul tracking bugs for this issue:

Affects: fedora-all [bug 2174278]
Comment 14 errata-xmlrpc 2023-03-23 02:16:31 UTC 
This issue has been addressed in the following products:

  Red Hat Migration Toolkit for Containers 1.7

Via RHSA-2023:1428 https://access.redhat.com/errata/RHSA-2023:1428
Comment 15 errata-xmlrpc 2023-03-30 12:35:57 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.4 Extended Update Support

Via RHSA-2023:1533 https://access.redhat.com/errata/RHSA-2023:1533
Comment 16 errata-xmlrpc 2023-04-04 09:48:17 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2023:1582 https://access.redhat.com/errata/RHSA-2023:1582
Comment 17 errata-xmlrpc 2023-04-04 09:48:33 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2023:1583 https://access.redhat.com/errata/RHSA-2023:1583
Comment 18 errata-xmlrpc 2023-04-12 14:58:44 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.6 Extended Update Support

Via RHSA-2023:1742 https://access.redhat.com/errata/RHSA-2023:1742
Comment 19 errata-xmlrpc 2023-04-12 14:59:06 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2023:1743 https://access.redhat.com/errata/RHSA-2023:1743
Comment 20 errata-xmlrpc 2023-04-12 15:07:46 UTC 
This issue has been addressed in the following products:

  Red Hat Software Collections for Red Hat Enterprise Linux 7

Via RHSA-2023:1744 https://access.redhat.com/errata/RHSA-2023:1744
Comment 23 errata-xmlrpc 2023-04-19 23:50:23 UTC 
This issue has been addressed in the following products:

  multicluster engine for Kubernetes 2.2 for RHEL 8

Via RHSA-2023:1887 https://access.redhat.com/errata/RHSA-2023:1887
Comment 24 errata-xmlrpc 2023-04-20 01:39:26 UTC 
This issue has been addressed in the following products:

  Red Hat Advanced Cluster Management for Kubernetes 2.7 for RHEL 8

Via RHSA-2023:1888 https://access.redhat.com/errata/RHSA-2023:1888
Comment 25 errata-xmlrpc 2023-05-01 18:25:53 UTC 
This issue has been addressed in the following products:

  multicluster engine for Kubernetes 2.1 for RHEL 8

Via RHSA-2023:2061 https://access.redhat.com/errata/RHSA-2023:2061
Comment 26 errata-xmlrpc 2023-05-02 16:19:34 UTC 
This issue has been addressed in the following products:

  Red Hat Advanced Cluster Management for Kubernetes 2.6 for RHEL 8

Via RHSA-2023:2083 https://access.redhat.com/errata/RHSA-2023:2083
Comment 27 errata-xmlrpc 2023-05-03 15:34:22 UTC 
This issue has been addressed in the following products:

  multicluster engine for Kubernetes 2.0 for RHEL 8

Via RHSA-2023:2098 https://access.redhat.com/errata/RHSA-2023:2098
Comment 28 errata-xmlrpc 2023-05-03 20:15:08 UTC 
This issue has been addressed in the following products:

  Red Hat Advanced Cluster Management for Kubernetes 2.5 for RHEL 8

Via RHSA-2023:2104 https://access.redhat.com/errata/RHSA-2023:2104
Comment 29 errata-xmlrpc 2023-05-09 11:46:31 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2023:2654 https://access.redhat.com/errata/RHSA-2023:2654
Comment 30 errata-xmlrpc 2023-05-09 11:46:47 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2023:2655 https://access.redhat.com/errata/RHSA-2023:2655
Comment 31 Product Security DevOps Team 2023-05-09 20:33:31 UTC 
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2022-25881
Comment 32 errata-xmlrpc 2023-06-27 11:29:02 UTC 
This issue has been addressed in the following products:

  RHINT Service Registry 2.4.3 GA

Via RHSA-2023:3815 https://access.redhat.com/errata/RHSA-2023:3815
Comment 34 errata-xmlrpc 2023-10-09 10:26:39 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.0 Extended Update Support

Via RHSA-2023:5533 https://access.redhat.com/errata/RHSA-2023:5533
Note You need to log in before you can comment on or make changes to this bug.